Category:Security:SSA: Difference between revisions
(→n: bind 9.7.4P1 seems to be not affected, only 9.7.4 is) |
(→n: add all infos for proftpd fix) |
||
| Line 41: | Line 41: | ||
== n == | == n == | ||
httpd | ==== httpd ==== | ||
CVE-2011-4415 CVE-2011-4317 CVE-2011-3607 CVE-2011-3368 | |||
dhcp | ==== dhcp ==== | ||
CVE-2011-4868 CVE-2011-4539 CVE-2011-2749 CVE-2011-2748 | |||
openssl | ==== openssl ==== | ||
CVE-2012-0027 CVE-2011-4619 CVE-2011-4576 CVE-2011-4109 CVE-2011-4108 CVE-2011-3210 | |||
proftpd : CVE-2011-4130 | ==== proftpd ==== | ||
[http://cvedetails.com/cve/CVE-2011-4130 CVE-2011-4130] ([http://bugs.proftpd.org/show_bug.cgi?id=3711 proftpd bug tracker #3711]) | |||
php | Use-after-free vulnerability in the Response API in ProFTPD '''before 1.3.3g''' allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer. | ||
==== php ==== | |||
CVE-2011-4885 CVE-2011-3379 | |||
== x == | == x == | ||
Revision as of 21:43, 29 January 2012
Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.
The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...
A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).
The CVEs are typically listed as follow: ${SUMMARY}
- Fix:
- Fixed upstream on: ${DATE}
- Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
- Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}
a
linux
ap
cups : CVE-2011-3170 CVE-2011-2896
d
perl
CVE-2011-2939
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow (on cve.mitre.org).
- Fix:
- Fixed upstream on: Tue, 9 Aug 2011
- Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
- Upstream commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5
ruby
CVE-2011-2705 CVE-2011-1004 CVE-2011-0188
e
emacs
l
t1lib : CVE-2011-1554 CVE-2011-1553 CVE-2011-1552 CVE-2011-0764
freetype2 : CVE-2011-0226
libxml2 : CVE-2011-1944
n
httpd
CVE-2011-4415 CVE-2011-4317 CVE-2011-3607 CVE-2011-3368
dhcp
CVE-2011-4868 CVE-2011-4539 CVE-2011-2749 CVE-2011-2748
openssl
CVE-2012-0027 CVE-2011-4619 CVE-2011-4576 CVE-2011-4109 CVE-2011-4108 CVE-2011-3210
proftpd
CVE-2011-4130 (proftpd bug tracker #3711)
Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.
php
CVE-2011-4885 CVE-2011-3379
x
libXfont : CVE-2011-2895
xap
pidgin : CVE-2011-4603 CVE-2011-4602 CVE-2011-4601 CVE-2011-3594 CVE-2011-3184 CVE-2011-2943
This category currently contains no pages or media.